An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the s…

Critical CVSS 9.8

CVECVE-2026-52608

First seen2026-08-20 17:16 UTC

Disclosed2026-08-18 18:18 UTC

Last updated2026-08-20 17:16 UTC

Channel statusauto

Summary

An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safe_mode setting leading to remote code execution.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://github.com/kilotel/vulnerability-research/tree/main/CVE-2026-52608
https://github.com/reportico-web/reportico

Timeline

2026-08-20 nvd_ingest NVD